# Retrieve a paginated list of individual EDR security alerts

Returns a paginated list of individual EDR security alerts. Each record includes the affected device, alert type, detection engine, severity, current ticket status, threat details, and timestamps. Supports filtering by detection source, last 24-hour alerts, alert name, and device name.

## Endpoint

`GET /edr/api/view/alerts`

## Request URL

`https://{server-hostname}:8383/edr/api/view/alerts`

## Scope

`EDR.READ`

## Header

`Authorization: d92d4xxxxxxxxxxxxx15f52`

## Request Parameters

### Request Headers

- **Accept** `string` — Mandatory
  - `application/json`

### Query Parameters

- **alert_status** `string` — Optional
  - Filter grouped alerts by status.
  - `0` - All
  - `1` - Unresolved
  - `3` - Resolved.
- **detection_source** `string` — Optional
  - Filter alerts by detection engine source code.
  - `0` - All
  - `1` - Ransomware
  - `2` - Behaviour
  - `3` - MC
  - `5` - Exfilter
  - `6` - Script.
- **filterLast24HrAlerts** `boolean` — Optional
  - When true, returns only alerts raised in the last 24 hours.
- **alertName** `string` — Optional
  - Filter alerts by process or file name (partial match supported, e.g., `example.exe`).
- **deviceName** `string` — Optional
  - Filter alerts by the hostname of the affected device (partial match supported, e.g., `example-hostname`).
- **page** `string` — Optional
  - Page number for pagination. Defaults to `1`.
- **pageLimit** `string` — Optional
  - Number of records per page. Default is `25`, maximum is `1000`.

## Sample Request

```curl
curl --request GET \
  --url 'https://appdomain/edr/api/view/alerts?alert_status=SOME_STRING_VALUE&detection_source=SOME_STRING_VALUE&filterLast24HrAlerts=SOME_BOOLEAN_VALUE&alertName=SOME_STRING_VALUE&deviceName=SOME_STRING_VALUE&page=SOME_STRING_VALUE&pageLimit=SOME_STRING_VALUE' \
  --header 'Accept: application/json' \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52'
```

## Response Parameters

### HTTP Code 200

#### Response Body: `application/json`

`JSON Object`

- **status** `string`
  - Response status. `success` if the request completed successfully, `failure` if an error occurred.
- **totalRecords** `string`
  - Total number of records matching the applied filters.
- **totalPages** `string`
  - Total number of pages available based on the current page limit.

### Sample Response: HTTP 200

Paginated list of individual EDR security alerts.

```json
{
  "metadata": {
    "limit": 25,
    "page": 3
  },
  "totalRecords": "51",
  "totalPages": 3,
  "status": "success",
  "Links": {
    "next": "null",
    "prev": "/edr/api/view/alerts?page=2&pageLimit=25"
  },
  "messageResponse": [
    {
      "incident_id": "6000000000000001",
      "alert_id_transform": "7000000000000001",
      "alert_name_transform": "sample_process.exe",
      "alert_image_path_transform": "C:\\Program Files\\Microsoft\\Edge\\Application\\sample_process.exe",
      "sha256_transform": "A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2",
      "process_id": "4000000000000001",
      "alert_process_id": "4000000000000001",
      "reason_transform": "DeepAV Engine",
      "severity_transform": "2",
      "ticket_status_transform": "1",
      "component_id": "3000000000000001",
      "managededrcomponent_component_id": "3000000000000001",
      "component_status": "1",
      "edrincidentalertmapping_alert_id": "7000000000000001",
      "detection_time_transform": "Jan 15, 2025 10:30 AM",
      "error_status": null,
      "resource_id": "2000000000000001",
      "resource_resource_id": "2000000000000001",
      "resource_name_transform": "DESKTOP-EXAMPLE",
      "customer_id": "1000000000000001",
      "customer_name": "John Doe"
    }
  ]
}
```

### HTTP Code 400

#### Response Body: `application/json`

`JSON Object`

- **errorCode** `string`
  - `EDRCOMMON001` — Internal server error occurred while retrieving the EDR alert list.
- **errorMessage** `string`
  - General internal error message.

### Sample Response: HTTP 400

Unexpected server-side error.

```json
{
  "errorMessage": "Exception while retrieving EDR alert list",
  "errorCode": "EDRCOMMON001"
}
```

### HTTP Code 429

#### Response Body: `application/json`

`JSON Object`

- **errorCode** `string`
  - Rate limit error code.
  - `IAM0019` — Returned when the API call threshold is exceeded within the allowed duration window.
- **errorMessage** `string`
  - Rate limit exceeded message with guidance on when to retry.

### Sample Response: HTTP 429

API call threshold exceeded.

```json
{
  "errorCode": "IAM0019",
  "url": "/edr/api/view/alerts",
  "errorMsg": "The URL /edr/api/view/alerts was called too many times. Please retry after a while."
}
```

## Rate Limits

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.